From 8d92a8fdb1d682e92947acc2e2ca108377298be9 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 11 Feb 2022 20:15:51 +0000
Subject: [PATCH] Separate eduGAIN download and processing

See ukf/ukf-meta#1.
---
 build.xml                    | 49 ++++++++++++++++++++++++++++++++++-
 dev.properties               |  6 +++++
 mdx/int_edugain/beans.xml    | 21 ++++++++++++---
 mdx/int_edugain/download.xml | 50 ++++++++++++++++++++++++++++++++++++
 4 files changed, 122 insertions(+), 4 deletions(-)
 create mode 100644 mdx/int_edugain/download.xml

diff --git a/build.xml b/build.xml
index 99fdfc58..04ebddbb 100644
--- a/build.xml
+++ b/build.xml
@@ -1546,6 +1546,37 @@
     </target>
 
 
+    <!--
+        *******************************************************
+        ***                                                 ***
+        ***   e d u G A I N   D O W N L O A D / C A C H E   ***
+        ***                                                 ***
+        *******************************************************
+    -->
+
+    <!--
+        flow.edugain.download
+
+        Downloads the eduGAIN aggregate and writes it into a file if successful.
+    -->
+    <target name="flow.edugain.download">
+        <echo>Downloading eduGAIN aggregate.</echo>
+        <CHANNEL.do channel="int_edugain" verb="download"/>
+        <echo>Download to ${mda.output.edugain.download} completed.</echo>
+    </target>
+
+    <!--
+        edugain.download.clear
+
+        Removes any already-downloaded copy of the eduGAIN aggregate.
+        This can be used at the start of a sequence of download attempts
+        to ensure that a much older success doesn't hide subsequent failures.
+    -->
+    <target name="edugain.download.clear">
+        <echo>Removing previously downloaded eduGAIN aggregate.</echo>
+        <delete file="${mda.output.edugain.download}" quiet="true" verbose="false"/>
+    </target>
+
     <!--
         *************************************************
         ***                                           ***
@@ -1585,8 +1616,11 @@
 
     <!--
         Unsigned metadata generation for the UK Federation.
+
+        This target assumes that the eduGAIN aggregate has
+        already been downloaded. It will fail if this is not the case.
     -->
-    <target name="samlmd.aggregates.generate">
+    <target name="flow.aggregates.generate">
         <echo>Generating unsigned UKfed metadata files.</echo>
 
         <!--
@@ -1624,6 +1658,18 @@
         <echo>Generated UK unsigned metadata.</echo>
     </target>
 
+    <!--
+        Unsigned metadata generation for the UK Federation.
+
+        This target removes any existing eduGAIN download, downloads a
+        new copy and then runs the aggregate generation flows.
+    -->
+    <target name="samlmd.aggregates.generate" depends="
+            edugain.download.clear,
+            flow.edugain.download,
+            flow.aggregates.generate
+        ">
+    </target>
 
     <!--
         ***************************
@@ -1652,6 +1698,7 @@
     <property name="mda.mdx.dir" value="${mdx.dir}"/>
     <property name="mda.members.dir" value="${members.dir}"/>
     <property name="mda.output.dir" value="${output.dir}"/>
+    <property name="mda.output.edugain.download" value="${output.dir}/edugain-download.xml"/>
     <property name="mda.sign.keyAlias" value="${sign.uk.keyAlias}"/>
     <property name="mda.sign.pkcs11Config" value="${sign.uk.pkcs11Config}"/>
     <property name="mda.mdq.output" value="${mdq.output.dir}"/>
diff --git a/dev.properties b/dev.properties
index 392d0c43..f6cc2353 100644
--- a/dev.properties
+++ b/dev.properties
@@ -6,3 +6,9 @@
 
 # Shared workspace location is assumed to be the parent directory.
 shared.ws.dir=${basedir}/..
+
+#
+# Cached eduGAIN download goes into a different directory so that it
+# persists over comparison runs.
+#
+mda.output.edugain.download=${shared.ws.dir}/temp/edugain-download.xml
diff --git a/mdx/int_edugain/beans.xml b/mdx/int_edugain/beans.xml
index 78a0412f..27d7e424 100644
--- a/mdx/int_edugain/beans.xml
+++ b/mdx/int_edugain/beans.xml
@@ -29,9 +29,13 @@
     <bean id="int_edugain_betaAggregate_url" parent="String">
         <constructor-arg value="http://mds.edugain.org/edugain-v1-beta.xml"/>
     </bean>
+    <!-- Downloaded copy of production aggregate. -->
+    <bean id="int_edugain_productionAggregate_file" parent="File">
+        <constructor-arg value="${output.edugain.download}"/>
+    </bean>
 
     <!--
-        Fetches the eduGAIN production aggregate.
+        Fetches the eduGAIN production aggregate from its designated URL.
 
         Other aggregates may be substituted if their location exists as a bean
         named "int_edugain_<ID>Aggregate_url" above, and the property
@@ -49,11 +53,22 @@
             <bean parent="HTTPResource">
                 <constructor-arg name="client" ref="httpClient"/>
                 <constructor-arg name="url"
-                	ref="int_edugain_${int.edugain.aggregate.name:production}Aggregate_url"/>
+                    ref="int_edugain_${int.edugain.aggregate.name:production}Aggregate_url"/>
             </bean>
         </property>
     </bean>
 
+    <!--
+        Fetches the downloaded copy of the eduGAIN production aggregate.
+    -->
+    <bean id="int_edugain_productionAggregate_fromFile" parent="mda.DOMResourceSourceStage">
+        <property name="parserPool" ref="parserPool"/>
+        <property name="DOMResource">
+            <bean parent="FileSystemResource"
+                c:_-ref="int_edugain_productionAggregate_file"/>
+        </property>
+    </bean>
+
     <!--
         eduGAIN signing certificate.
     -->
@@ -80,7 +95,7 @@
     <bean id="int_edugain_productionEntities" parent="mda.CompositeStage">
         <property name="composedStages">
             <list>
-                <ref bean="int_edugain_productionAggregate"/>
+                <ref bean="int_edugain_productionAggregate_fromFile"/>
 
                 <!--
                     Check for fatal errors at the aggregate level:
diff --git a/mdx/int_edugain/download.xml b/mdx/int_edugain/download.xml
new file mode 100644
index 00000000..844f12f9
--- /dev/null
+++ b/mdx/int_edugain/download.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Download eduGAIN aggregate.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+    <!--
+        Import commonly used beans.
+    -->
+    <import resource="classpath:common-beans.xml"/>
+
+    <!--
+        Import eduGAIN channel beans.
+    -->
+    <import resource="classpath:int_edugain/beans.xml"/>
+
+    <!--
+        Download eduGAIN aggregate.
+    -->
+    <bean id="download" parent="mda.SimplePipeline">
+        <property name="stages">
+            <list>
+                <ref bean="int_edugain_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
+                <ref bean="int_edugain_checkSignature"/>
+                <ref bean="errorTerminatingFilter"/>
+
+                <!-- Write the downloaded aggregate out to a file. -->
+                <bean id="serializeImported" parent="mda.SerializationStage"
+                    p:serializer-ref="serializer"
+                    p:outputFile-ref="int_edugain_productionAggregate_file"/>
+            </list>
+        </property>
+    </bean>
+
+</beans>